Framework for Internal Control Systems in Banking Organisations

- 27 -
Appendix II
Supervisory Lessons Learned from Internal Control Failures
A. Management Oversight and the Control Culture
1. Many internal control failures that resulted in significant losses for banks could
have been substantially lessened or even avoided if the board and senior management of the
organisations had established strong control cultures. Weak control cultures often had two
common elements. First, senior management failed to emphasise the importance of a strong
system of internal control through their words and actions, and most importantly, through the
criteria used to determine compensation and promotion. Second, senior management failed to
ensure that the organisational structure and managerial accountabilities were well defined. For
example, senior management failed to require adequate supervision of key decision-makers
and reporting of the nature and conduct of business activities in a timely manner.
2. Senior management may weaken the control culture by promoting and rewarding
managers who are successful in generating profits but fail to implement internal control
policies or address problems identified by internal audit. Such actions send a message to
others in the organisation that internal control is considered secondary to other goals in the
organisation, and thus diminish the commitment to and quality of the control culture.
3. Some banks with control problems had organisational structures in which
accountabilities were not clearly defined. As a result, a division of the bank was not directly
accountable to anyone in senior management. This meant that no senior manager monitored
the performance of these activities closely enough to notice unusual activities, financial and
otherwise, and no senior manager had a comprehensive understanding of the activities and
how profits were being generated. If management had understood the activities of the
division, they may have been able to recognise warning signs (such as an unusual relationship
of profit to levels of risk), investigate the operations and take steps to reduce the eventual
losses. These problems could also have been avoided if line management had reviewed
transactions and management information reports and held discussions with appropriate
personnel about the nature of business transacted. Such approaches provide line management
with an objective look at how decisions are being made and ensures that key personnel are
operating within the parameters set by the bank and within the internal control framework.
B. Risk Recognition and Assessment
4. In the recent past, inadequate risk recognition and assessment has contributed to
some organisations’ internal control problems and related losses. In some cases, the potential